benefits of "HTTP authentication with PHP"

Question

what are the benefits of using HTTP authentication with PHP (HTTP 401 headers)
instead of using a normal form submit authentication??

Answer 1

Your question is a bit vague, but the general answer is that using this method gives you a more "RESTful" implementation that follows what HTTP is already good at. In this case, throwing a 401 is something that other web servers, web proxies and web browsers know how to handle. If you're just spitting out an HTML form it is only actionable by an end user whereas using the HTTP status codes allow machine interaction.

I'd recommend checking out http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol to understand what HTTP really is. I think that should make all of this make more sense.

Answer 2

You make websites? if yes, then use the <form> tag.. it's prettier ;)

You make apps to be accessed by other apps and dispatch some form of data? Then use HTTP auth.

As far as I know there is no big difference in security terms, or speed or whatever..it's just ugly and easier to implement.

Answer 3

As an example of what revolutiontrigger said, I most often use HTTP auth on RSS feeds for sites that use form-based auth, simply because many RSS readers can do HTTP auth, but can't do form-based auth.

Answer 4

From security perspective, both the form based and HTTP Basic Access Authentication use plain text for sending the authentication data. (Sure, HTTP Basic Auth additionally uses Base64, but that’s no hitch.)

While HTTP Basic Auth sends the authentication data on every request, the form based authentication only sends the authentication data when the form is sent (remember: both in plain text). Commonly sessions are used to maintain the state when using form based authentication.

So if you want to use one of these, be sure to encrypt your connection using HTTPS to prevent sniffing and man-in-the-middle attacks. And when you choose the form and session based variant, be sure to secure your session handling too to prevent or at least detect session frauds like Session Hijacking and Session Fixation.

The last variant is HTTP Digest Access Authentication. The main difference between this and Basic is, that Digest is a challenge-response authentication whereas the client has to fulfill a challenge on every request and the response is just a MD5 hash. So no authentication data in plain text is being send.